Microsoft is Planning to Remove VBScript from Windows permanently from future versions of Windows. Do you know VBScript is a programming language that came with Internet Explorer? After being used for 30 years, Microsoft is getting ready to stop using VBScript in future versions of Windows slowly.
You will have the option to use VBScript before it’s completely removed from the operating system. Microsoft plans to make it available on request (on-demand feature). This way, you can continue using it until it’s eventually phased out.
The IE browser is already retired from mainstream versions of the Windows operating system. It’s important to understand that Internet Explorer mode in Microsoft Edge is still supported. This includes the Internet Explorer platform (MSHTML/Trident), WebOC, and COM automation.
VBScript, Visual Basic Script, or Microsoft Visual Basic Scripting Edition is a programming language. It’s similar to Visual Basic and Visual Basic for Applications (VBA). It first came out nearly 30 years ago, back in August 1996.
Table of Contents
What is VBScript?
VBScript, short for Visual Basic Script, is a programming language developed by Microsoft. It was primarily used for scripting tasks in Windows environments.
Why is Microsoft Discontinuing VBScript in Windows?
Microsoft is stopping the use of VBScript to enhance security and prevent the delivery of malware. Malicious actors have exploited VBScript to distribute harmful software.
When will VBScript be Removed from Windows?
The exact timeline hasn’t been specified, but it’s part of Microsoft’s plan for future Windows releases.
Microsoft is Planning to Remove VBScript from Windows Permanently
VBScript, which was bundled with Internet Explorer (though it was discontinued on specific Windows 10 versions earlier this year), is closely integrated with Windows. It communicates with host applications through Windows Script, enhancing the functionality of various programs.
| Feature | Details and Mitigation | Deprecation Announced |
|---|---|---|
| VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on-demand before its removal from the operating system. | October 2023 |
- Enable Internet Explorer IE Mode in Microsoft Edge
- Configure Enterprise Mode Site List to use IE Mode
- Disable Internet Explorer using Intune Group Policy Browser App
- 3 Zero Day and 104 flaws – October Patch Tuesday
VBScript in Windows
Microsoft’s decision to phase out VBScript holds significant importance regarding security. This move aims to strengthen the safety of Windows systems by eliminating a potential vulnerability that malicious actors could exploit. By discontinuing VBScript, Microsoft is taking a proactive step towards safeguarding users from potential security risks associated with this scripting language.
- Deprecation of VBScript – Microsoft is stopping the use of VBScript.
- Feature on Demand – In future Windows releases, VBScript will be offered as an optional feature that users can choose to install.
- Preinstalled Initially – VBScript will come preinstalled to allow for uninterrupted use.
- Scheduled Removal – VBScript will be removed entirely from the operating system.
- Transition Recommendation – Users are encouraged to transition to more modern and secure Windows-supported scripting languages.
- Security Enhancement – This move aims to enhance security and prevent malware delivery.
- Integration with Internet Explorer – VBScript was bundled with Internet Explorer, but Internet Explorer itself has been discontinued on some Windows 10 platforms.
- Integration with Windows – VBScript integrates active scripting into Windows environments, enabling communication with host applications through Windows Script.
- Start menu > Settings app > Apps > Optional Features
Add an Optional Feature
In Windows 11, a notable addition to the Settings app is the “Add an Optional Features.” This feature allows users to customize their Windows experience by choosing which additional functionalities and tools they want to install or enable.
Microsoft’s Move and Attack Vector Elimination
VBScript, a type of computer code, is being phased out. This means it’s being slowly replaced and won’t be used anymore. One important thing to know is that this change is making it harder for hackers to attack Windows computers using a standard method.
Importance of the Retirement of VBScript
In 2018, Microsoft took steps to defend against attacks using VBA macros. However, this led cybercriminals to use VBScript to spread malware like DarkGate, Lokibot, Qbot, Emotet, and other malicious software.
- This shift highlights the importance of Microsoft’s decision to phase out VBScript. It’s a move towards a safer Windows environment.
Use Sysmon to Monitor VBScript Usage
We can check out System Monitor (Sysmon) and set it up to track its dynamic link libraries (.dll) to monitor how VBScript is being used across our whole organization. The user can collect and look through the Sysmon logs on all the Windows machines to spot any vbscript.dll loads.
Using Sysmon for monitoring can slow things down and create some extra work, especially if we are using it on a lot of devices. It’s a good idea to try it out on a few devices first to see how it affects performance before rolling it out everywhere.
| Configure .dll Load Tracking and Deploy Sysmon | Collect Sysmon logs of .dll Loads |
|---|---|
| Edit Sysmon configuration file > Reload it using the Sysinternals Sysmon utility > Open an elevated command prompt and run: Sysmon64.exe -c sysmon-config.xml > Verify the current configuration by running: Sysmon64.exe -c | In the Event Viewer, go to Applications and Services Logs > Locate Microsoft > Windows > Sysmon on the left navigation bar > Select Operational > In the Actions pane on the right, filter the log by Event ID 7, Sysmon. |
Review VBScript Dependencies
In many enterprise settings, VBScript dependencies may be embedded in any of the following centrally managed locations. With this strategy, we will identify these scripts in preparation for their remediation and VBScript removal.
- Group Policy logon scripts
- Group Policy logoff scripts
- Group Policy startup scripts
- Group Policy shutdown scripts
- Scheduled tasks configured to launch legacy scripts
- PowerShell scripts deployed via Intune that invoke .vbs scripts indirectly
Scan for .vbs Files Across the System
To help out with enterprise’s other detection methods, proactively search for .vbs script files on the devices. This helps surface any legacy script usage not tied to scheduled tasks or GPOs.
Caution: Avoid scanning the entire C:\ blindly in production. It can cause performance issues or access errors. Focus on user- and script-relevant paths.
Systematically search for .vbs files in commonly used directories such as:
- C:\Users\
- C:\ProgramData\
- C:\Program Files\
- C:\Program Files (x86)\
- C:\Scripts\
- C:\Windows\ (optional: might include noise)
Scan Custom MSI Packages for Embedded VBScript
Custom Microsoft Installer (MSI) packages may contain embedded VBScript through custom actions. This was a common packaging practice in older enterprise applications. These scripts usually run in the background during installation, fixing, or uninstalling. Don’t overlook them during the modernization efforts.
- Detect custom action
- Scaling recommendations
- Remediation options for MSI packages using VBScript
Solution When VBScript is Monitored
These four detection methods give us a clear look at VBScript dependencies on our Windows systems. This info is very important for planning how to fix things and planning effective remediation and aligning with future-proof technologies.
Deprecated features in the Windows client – What’s new in Windows | Microsoft Learn
VBScript deprecation: Detection strategies for Windows
Author
About the Author – Vidya is a computer enthusiast. She is here to share quick tips and tricks with Windows 11 or Windows 10 users. She loves writing on Windows 11 and related technologies. She is also keen to find solutions and write about day-to-day tech problems.